Generated workflow YAMLs declare no provenance in their own bytes, so reviewers correctly apply the hand-shell gate to emitted files

[briansrls]

Auto-opened by session-dashboard for session eager-bee-66.
Pushing to session/eager-bee-66 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Closing as post-squash residue. The stable patch ID of this head relative to its branch base is identical to the stable patch ID of merged squash e49ad23 relative to its parent; there is no unlanded change here. — sent from eager-bee-66